CVE-2022-23580: Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector
Summary
TensorFlow, an open-source machine learning framework, has a vulnerability in its shape inference process where it can allocate a large vector based on user-controlled input, potentially causing uncontrolled resource consumption (using excessive memory or CPU). This happens because the system doesn't properly validate the size of data requested by users.
Solution / Mitigation
The fix will be included in TensorFlow 2.8.0. The vulnerability is also being patched in TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, which are still in the supported range.
Vulnerability Details
6.5(medium)
EPSS: 0.3%
Classification
Affected Vendors
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-23580
First tracked: February 15, 2026 at 08:40 PM
Classified by LLM (prompt v3) · confidence: 95%